Legal · Last updated 2026-05-11
Privacy Policy
This Privacy Policy explains how Soft Routes Sp. z o.o. ("we", "our") processes your personal data when you visit this website, contact us, or subscribe to our newsletter. We process personal data in accordance with Regulation (EU) 2016/679 (the GDPR) and the Polish Act of 10 May 2018 on the Protection of Personal Data.
1. Data controller
The data controller is Soft Routes Sp. z o.o., registered at ul. Marszałkowska 1, 00-001 Warszawa, Poland, KRS: 0000000000, NIP: 000-00-00-000. For any privacy request, write to privacy@softroutes.com.
2. What data we collect and why
We process personal data only for clearly defined purposes:
- Contact form. Name, email, company, project details, and message content. Purpose: to respond to your inquiry and pursue a potential engagement. Legal basis: GDPR Art. 6(1)(b) — steps prior to entering a contract — and Art. 6(1)(f) — our legitimate interest in handling business inquiries.
- Analytics. Aggregated, non-identifying usage statistics through Plausible Analytics — a cookieless analytics tool that does not collect personal data, IP addresses in identifiable form, or use cross-site tracking. We load analytics only after you accept the analytics category in our cookie banner. Legal basis: Art. 6(1)(a) — your consent.
- Server logs. Standard request logs (IP address, user agent, timestamp, URL) retained for a short period for security, abuse prevention, and incident response. Legal basis: Art. 6(1)(f) — our legitimate interest in operating a secure service.
3. How long we keep data
- Contact inquiries: up to 24 months after the last interaction, then deleted.
- Server logs: typically 30–90 days, depending on the system.
- Accounting / contracts: 5 years from the end of the relevant tax year, as required by Polish law.
4. Who we share data with
We share data only with processors who help us operate the site and our business, under written data-processing agreements. Categories of recipients:
- Cloud hosting and CDN providers (e.g. Vercel).
- FormSubmit (operated by ScreenshotApi LLC, United States) — relays contact-form submissions to our inbox. Personal data transferred: the fields you enter in the form. We do not store the data with FormSubmit beyond delivery.
- Analytics provider (Plausible — EU-hosted, cookieless).
- Accounting and legal advisors, where required by law or contract.
Where data is transferred outside the European Economic Area (e.g. to FormSubmit in the United States), we rely on Standard Contractual Clauses or an adequacy decision recognised by the European Commission. If you do not wish to use the form, you can write to hello@softroutes.com directly.
5. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erase your data ("right to be forgotten") where applicable.
- Restrict or object to processing based on legitimate interests.
- Data portability.
- Withdraw consent at any time, without affecting prior lawful processing.
- Lodge a complaint with the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) at uodo.gov.pl.
To exercise any of these rights, email privacy@softroutes.com. We respond within 30 days.
6. Cookies
We use only strictly necessary cookies by default. Analytics is loaded only after your explicit consent. See our Cookie Policy for the full list and to change your preferences.
7. Security
We apply reasonable technical and organisational measures — TLS in transit, restricted access, audit logging — to protect personal data against unauthorised access, loss, or alteration. No system is perfectly secure; we will notify affected users and the UODO within 72 hours of any breach that meets the GDPR threshold.
8. Changes to this policy
We may update this Privacy Policy. Material changes will be announced on this page and, where appropriate, by email. The "Last updated" date at the top reflects the most recent revision.
Questions? Email privacy@softroutes.com.